CVE-2026-87613: Use of Incorrectly-Resolved Name or Reference

Incorrect reference resolution in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: Medium...

CVE-2026-87514: Use After Free

Use after free in Views in Google Chrome prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. Chromium security severity: High...

CVE-2026-87646: Use After Free

Use after free in Web Authentication in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-87558: Use After Free

Use after free in Payments in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-87488: Use After Free

Use after free in WebGL in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-87528: Access of Resource Using Incompatible Type

Type confusion in Rust in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87633: Use After Free

Use after free in Views in Google Chrome prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via UI Interaction. Chromium security severity: High...

Oracle Outside In Technology PDF File Parsing Integer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oracle Outside In Technology. User interaction is required to exploit this vulnerability in that the target must open a malicious file or visit a malicious page. The specific flaw exists within the...

Oracle Outside In Technology GEM File Parsing Integer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oracle Outside In Technology. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Oracle Outside In Technology WPS File Parsing Memory Corruption Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oracle Outside In Technology. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Oracle Outside In Technology PostScript File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oracle Outside In Technology. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2026-87500: Improper Validation of Array Index

Improper validation of array index in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-87448: Use After Free

Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Low...

CVE-2026-87464: Use After Free

Use after free in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

NLTK: Corpus Reader Sandbox Bypass

Summary NLTK corpus-reader constructors can still reach outside-root file and database reads before the nltk.pathsec sandbox boundary is enforced. The PoC shows the safe path blocked by pathsec.open, then LinThesaurusCorpusReader and PanLexLiteCorpusReader succeeding in the same process. Affected...

GHSA-P4RW-RVV2-7XWR NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement

Summary Several corpus readers still step outside NLTK's symlink-aware trusted-root model. They derive in-root paths from trusted corpus state, convert those paths back into plain strings, and reopen them with built-in open rather than nltk.pathsec.open. Details - Vulnerability type: Path travers...

NLTK: Stable FrameNet and NKJP readers parse outside-root XML

Summary Published nltk==3.9.4 still contains several XML-reader entrypoints that build parser paths from caller-controlled selectors or trusted-looking index state without preserving the corpus-root boundary. Details - Vulnerability type: Path traversal and trusted-root bypass - Affected componen...

Malicious code in @web2apk/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ad4c3329ebb2fdeb3b9ddc93abcb5f3dab6773f7a7999ff96d063d49edc04d9 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in service-home (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ffce66fb482d77c6fcfcf9cf3ab50c0de30f856921f4a90f9de969212a2687f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16031 Malicious code in cb-wallet-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 16b89e0045c311aec83f8b4710dc1709b64bf083541c7ad26d639b89f5c98a7b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...